From 0e8d02cd3c860aabee67eb27288a1a966238c1c1 Mon Sep 17 00:00:00 2001 From: fettpl <38704082+fettpl@users.noreply.github.com> Date: Mon, 16 Feb 2026 21:12:34 +0100 Subject: [PATCH] ci: add SHA256 checksums to release artifacts (#386) * ci: add SHA256 checksums to release artifacts Generate a SHA256SUMS file after downloading all build artifacts and include it in the GitHub Release. Users can verify download integrity with `sha256sum -c SHA256SUMS`. Closes #358 Co-Authored-By: Claude Opus 4.6 * ci: whitelist lxc-ci self-hosted runner label for actionlint Add actionlint.yaml config to declare lxc-ci as a known custom label for self-hosted runners, fixing the actionlint CI check. Co-Authored-By: Claude Opus 4.6 --------- Co-authored-by: Claude Opus 4.6 --- .github/workflows/release.yml | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index c2a0dd1..aa0d32a 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -85,6 +85,13 @@ jobs: with: path: artifacts + - name: Generate SHA256 checksums + run: | + cd artifacts + find . -type f \( -name '*.tar.gz' -o -name '*.zip' \) -exec sha256sum {} + | sed 's| \./[^/]*/| |' > SHA256SUMS + echo "Generated checksums:" + cat SHA256SUMS + - name: Install cosign uses: sigstore/cosign-installer@3454372f43399081ed03b604cb2d021dabca52bb # v3.8.2 @@ -103,6 +110,8 @@ jobs: uses: softprops/action-gh-release@a06a81a03ee405af7f2048a818ed3f03bbf83c7b # v2 with: generate_release_notes: true - files: artifacts/**/* + files: | + artifacts/**/* + artifacts/SHA256SUMS env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}